Login Request a demo
BI
Product
bigbluebutton
by bigbluebutton · last CVE Aug 20, 2026
61
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities61In the news0Timeline
Severity mix
Critical 3High 16Medium 36Low 6
Severity
All severities61Critical3High16Medium36Low6
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add bigbluebutton to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-27605
9.8
1%
Oct 21
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
Affected: through 2.2.28
CVE-2020-27602
9.8
1%
Oct 21
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken
Affected: before 2.2.7
CVE-2020-12443
9.8
4%
Apr 29
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case)…
Affected: before 2.2.6
CVE-2023-42803
8.8
1%
Oct 30
BigBlueButton Unrestricted File Upload vulnerability
Affected: < 2.6.0-beta.2
CVE-2026-46682
8.5
1%
Aug 20
BigBlueButton: Blind SQL Injection AUTH (Moderator)
Affected: < 3.0.23
CVE-2020-27613
8.4
0%
Oct 21
The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access
Affected: before 2.2.28
CVE-2026-27466
8.2
0%
Feb 21
BigBlueButton: Exposed ClamAV port enables Denial of Service
Affected: < 3.0.22
CVE-2026-46353
8.1
0%
Jul 16
BigBlueButton API checksum bypass via presentationUploadExternalUrl
Affected: < 3.0.21
CVE-2026-46351
8.1
0%
Jul 16
BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them
Affected: < 3.0.21
CVE-2025-61602
7.5
0%
Oct 9
BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId
Affected: < 3.0.13
CVE-2025-61601
7.5
0%
Oct 9
BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation
Affected: < 3.0.13
CVE-2022-23488
7.5
1%
Dec 17
BigBlueButton is an open source web conferencing system
Affected: before 2.4; 2.4; 2.4; 2.4; 2.4; 2.4; +6 more
CVE-2022-29169
7.5
2%
Jun 1
BigBlueButton is an open source web conferencing system
Affected: 2.2.0 before 2.3.19; 2.4.0 before 2.4.7; 2.5; 2.5; 2.5; 2.5; +3 more
CVE-2020-29043
7.5
1%
Nov 26
An issue was discovered in BigBlueButton through 2.2.29
Affected: through 2.2.29
CVE-2020-27610
7.5
1%
Oct 21
The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external interfaces, and does not automatically set up a firewall…
Affected: before 2.2.28
CVE-2020-27603
7.5
3%
Oct 21
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files
Affected: before 2.2.27
CVE-2020-12112
7.5
5%
Apr 23
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion
Affected: before 2.2.5
CVE-2020-27611
7.3
1%
Oct 21
BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint
Affected: through 2.2.28
CVE-2026-46355
7.1
0%
Aug 20
BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
Affected: < 3.0.23
CVE-2026-46404
6.8
0%
Jul 16
BigBlueButton: Presentation URL Security Hardening
Affected: < 3.0.23
CVE-2026-27737
6.5
0%
May 18
BigBlueButton has Stored XSS in bbb-playback replay
Affected: < 3.0.19
CVE-2026-41127
6.5
0%
Apr 21
BigBlueButton's missing authorization allows viewer to inject/overwrite captions
Affected: < 3.0.24
CVE-2023-33176
6.5
0%
Jun 26
Blind SSRF When Uploading Presentation in BigBlueButton
Affected: >= 2.6.0, < 2.6.9; < 2.5.18
CVE-2022-29232
6.5
1%
Jun 1
BigBlueButton is an open source web conferencing system
Affected: 2.2.0 before 2.3.9; 2.4; 2.4
CVE-2020-27607
6.5
1%
Oct 21
In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client
Affected: before 2.2.28
CVE-2020-27604
6.5
1%
Oct 21
BigBlueButton before 2.3 does not implement LibreOffice sandboxing
Affected: before 2.2.8
CVE-2020-25820
6.5
10%
Oct 21
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink…
Affected: before 2.2.27
CVE-2026-27736
6.1
0%
Feb 25
BigBlueButton has Open Redirect vulnerability in ApiController
Affected: >= 3.0.0, < 3.0.20
CVE-2022-31065
6.1
1%
Jun 27
BigBlueButton is an open source web conferencing system
Affected: 2.4 before 2.4.8; 2.3.0; 2.4.9; 2.5; 2.5; 2.5; +9 more
CVE-2021-4143
6.1
1%
Jan 19
Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0
Affected: before 2.4.0
CVE-2020-27608
6.1
1%
Oct 21
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension…
Affected: before 2.2.28
CVE-2020-12113
6.1
1%
Apr 23
BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used
Affected: before 2.2.4
CVE-2022-41964
5.7
1%
Dec 16
BigBlueButton is an open source web conferencing system
Affected: 2.4; 2.4; 2.4; 2.4; 2.4; 2.4; +7 more
CVE-2026-55491
5.4
0%
Aug 20
BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
Affected: < 3.0.29
CVE-2025-55200
5.4
0%
Oct 9
BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes
Affected: < 3.0.13
CVE-2023-43798
5.4
0%
Oct 30
BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)
Affected: < 2.6.12; >= 2.7.0-alpha.1, < 2.7.0-rc.1
CVE-2023-43797
5.4
0%
Oct 30
BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
Affected: < 2.6.11; >= 2.7.0-alpha.1, < 2.7.0-beta.3
CVE-2022-31064
5.4
1%
Jun 27
BigBlueButton is an open source web conferencing system
Affected: 2.4 before 2.4.8; 2.3.0; 2.4.9; 2.5; 2.5; 2.5; +9 more
CVE-2022-27238
5.4
0%
Jun 24
BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality
Affected: through 2.4.7
CVE-2023-42804
5.3
0%
Oct 30
BigBlueButton Path Traversal – Reading Certain File Extensions
Affected: < 2.6.0-beta.1
CVE-2022-29235
5.3
1%
Jun 2
BigBlueButton is an open source web conferencing system
Affected: 2.2.0 before 2.3.18; 2.4; 2.4; 2.4; 2.4; 2.4; +5 more
CVE-2020-28954
5.3
1%
Nov 19
web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name
Affected: before 2.2.29
CVE-2020-27609
5.3
1%
Oct 21
BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface
Affected: through 2.2.28
CVE-2020-27606
5.3
1%
Oct 21
BigBlueButton before 2.2.28 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie…
Affected: before 2.2.28
CVE-2026-55489
4.9
0%
Aug 20
BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
Affected: < 3.0.29
CVE-2024-38518
4.6
0%
Jun 28
bbb-web API additional parameters considered
Affected: < 2.6.18; >= 2.7.0, < 2.7.8; >= 2.8.0, < 3.0.0-alpha.7
CVE-2026-41126
4.3
0%
Apr 21
BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"
Affected: < 3.0.24
CVE-2022-23490
4.3
0%
Dec 16
BigBlueButton is an open source web conferencing system
Affected: before 2.4.0
CVE-2022-41961
4.3
0%
Dec 16
BigBlueButton is an open source web conferencing system
Affected: before 2.4; 2.4; 2.4; 2.4; 2.4; 2.4; +5 more
CVE-2022-41960
4.3
0%
Dec 16
BigBlueButton is an open source web conferencing system
Affected: before 2.4.3
Page 1 of 2 · 61 total
12